Couldn't it then just publish the mock in a public place... it would get replaced by the real secret.? How is this prevented